CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
41.1%
The xmlattr
filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /
, >
, or =
, as each would then be interpreted as starting a separate attribute. If an application accepts keys (as opposed to only values) as user input, and renders these in pages that other users see as well, an attacker could use this to inject other attributes and perform XSS. The fix for the previous GHSA-h5c8-rqwp-cp95 CVE-2024-22195 only addressed spaces but not other characters.
Accepting keys as user input is now explicitly considered an unintended use case of the xmlattr
filter, and code that does so without otherwise validating the input should be flagged as insecure, regardless of Jinja version. Accepting values as user input continues to be safe.
github.com/advisories/GHSA-h75v-3vvj-5mfj
github.com/pallets/jinja/commit/0668239dc6b44ef38e7a6c9f91f312fd4ca581cb
github.com/pallets/jinja/security/advisories/GHSA-h75v-3vvj-5mfj
lists.fedoraproject.org/archives/list/[email protected]/message/567XIGSZMABG6TSMYWD7MIYNJSUQQRUC
lists.fedoraproject.org/archives/list/[email protected]/message/GCLF44KY43BSVMTE6S53B4V5WP3FRRSE
lists.fedoraproject.org/archives/list/[email protected]/message/SSCBHIL6BYKR5NRCBXP4XMP2CEEKGFVS
lists.fedoraproject.org/archives/list/[email protected]/message/ZALNWE3TXPPHVPSI3AZ5CTMSTAVN5UMS
nvd.nist.gov/vuln/detail/CVE-2024-34064